With the explosion of electronic commerce and digital personal information, facilitated by the rapid growth of the Internet, focus has been placed on the protection of financial and personal data. One element in protecting these data is encryption. Encryption is the process of converting information into an unintelligible form except to holders of a specific cryptographic key. By encrypting the information, it is protected against unauthorized disclosure.
Encryption is accomplished through a cryptographic algorithm. The algorithm is used to “lock” the information at one point and “unlock” it at another. Keys are used to lock and unlock the information. In a secret-key or symmetric key encryption, the same key is used to lock and unlock (encrypt and decrypt) the information. In public key or asymmetric key encryption, a public key is used to encrypt the information and a private key is used to decrypt the information. A key is often a numerical value. The length of the key generally determines the relative security of the key.
Many types of information use encryption. One example is the payment card industry, including credit card data and other financial information. Indeed, the credit card industry had taken great steps to ensure that financial data and transaction data is protected. For example, cardholder data must be encrypted when it is stored or transmitted over a public network. This requirement covers everything from producing the credit cards, including information stored on the magnetic strip or embedded chip on the card, to authenticating and authorizing transactions made with the card. One key piece of data that must be encrypted is a user's personal identification number (PIN).
Financial institutions employ interactive voice response (IVR) applications to support customer transactions. Typically, a customer will call a telephone number for the system. An automated system will provide recorded instructions to the user, such as, “for inquiries about a checking account, press 1.” The customer uses the number key pad on a telephone to select menu items and enter alphanumeric data, such as an account number.
However, one option that is not available using an IVR application is for the customer to activate an account or card by supplying a PIN or password or to change a PIN, password, or other sensitive information, while providing a secure platform for the information. Current standards and best practices require this information to be encrypted and stored on a host system that supports account management or transaction authorization. PINs, passwords, and other similar information must be encrypted to protect the integrity of the PIN and, as a result, the underlying financial information. Current IVR applications cannot encrypt this data.
What is needed are systems and methods that provide for encrypting sensitive information used in financial or other transactions conducted using an IVR application.